A storage system typically comprises one or more storage devices into which information may be entered, and from which information may be obtained, as desired. The storage system includes a storage operating system that functionally organizes the system by, inter alia, invoking storage operations in support of a storage service implemented by the system. The storage system may be implemented in accordance with a variety of storage architectures including, but not limited to, a network-attached storage environment, a storage area network and a disk assembly directly attached to a client or host computer. The storage devices are typically disk drives organized as a disk array, wherein the term “disk” commonly describes a self-contained rotating magnetic media storage device. The term disk in this context is synonymous with hard disk drive (HDD) or direct access storage device (DASD).
The storage operating system of the storage system may implement a high-level module, such as a file system, to logically organize the information stored on volumes as a hierarchical structure of data containers, such as files and logical units. For example, each “on-disk” file may be implemented as set of data structures, i.e., disk blocks, configured to store information, such as the actual data for the file. These data blocks are organized within a volume block number (vbn) space that is maintained by the file system. The file system may also assign each data block in the file a corresponding “file offset” or file block number (fbn). The file system typically assigns sequences of fbns on a per-file basis, whereas vbns are assigned over a larger volume address space. The file system organizes the data blocks within the vbn space as a “logical volume”; each logical volume may be, although is not necessarily, associated with its own file system.
A known type of file system is a write-anywhere file system that does not overwrite data on disks. If a data block is retrieved (read) from disk into a memory of the storage system and “dirtied” (i.e., updated or modified) with new data, the data block is thereafter stored (written) to a new location on disk to optimize write performance. A write-anywhere file system may initially assume an optimal layout such that the data is substantially contiguously arranged on disks. The optimal disk layout results in efficient access operations, particularly for sequential read operations, directed to the disks. An example of a write-anywhere file system that is configured to operate on a storage system is the Write Anywhere File Layout (WAFL®) file system available from Network Appliance, Inc., Sunnyvale, Calif.
The storage system may be further configured to operate according to a client/server model of information delivery to thereby allow many clients to access data containers stored on the system. In this model, the client may comprise an application, such as a database application, executing on a computer that “connects” to the storage system over a computer network, such as a point-to-point link, shared local area network (LAN), wide area network (WAN), or virtual private network (VPN) implemented over a public network such as the Internet. Each client may request the services of the storage system by issuing file-based and block-based protocol messages (in the form of packets) to the system over the network.
Many storage systems include an event monitoring system (EMS) that conveys appropriate system information and event notifications to system administrators and/or other interested parties, such as a vendor's customer support staff. Most UNIX-based systems use the conventional syslog program as an EMS. An administrator may configure syslog to forward event notifications based on severity level and module that generated the event. For example, an administrator may configure the syslog to send all events of a critical level from the kernel of the storage operation system to the administrator. No other levels of granularity may be specified when using the syslog program. However, a noted disadvantage of such syslog-based systems is that they typically produce too many event notifications. A single event may be generated multiple times, thereby resulting in the administrator receiving multiple notifications for the same event. As a result, certain event occurrences may generate tens or hundreds of identical event messages, which can overwhelm an administrator and potentially obscure other more important, event notifications.
Another noted disadvantage of the syslog program is that different vendors may assign different levels of severity to events. For example, an event which the vendor deems as routine may be deemed by the administrator to be critical. Consequentially, the administrator may configure syslog to send event notifications for all routine events, to ensure notification of the one routine event that is of interest. However, this results in the administrator receiving numerous unwanted event messages, i.e., event notifications for all other events that the vendor deems to be routine, even though they are of no interest to the administrator.
A further noted disadvantage of the syslog program is that syslog is limited to a single node. In clustered systems, syslog has no knowledge of other nodes in the same cluster, which results in an inability to filter duplicate event notification messages that are generated from different storage systems. For example, a disk array failure may cause multiple copies of the same event notification to be generated from each storage system connected to the disk array. Syslog is unable to filter these messages, thereby resulting in an administrator receiving numerous duplicate event notification messages.